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REMARKS 

The Office examined claims 1-20 and rejected same. With 
this paper, claims 1 and 14 are changed to even more distinctly 
claim the invention, and claims 4 and 14 are changed in response 
to an assertion of missing antecedent. Claims 1-20 remain 
pending . 

Changes to the claims 

Based on conversation with the two Examiners who have 
examined this application, it has become clear that it would be 
helpful to add clarifying language to the independent claims (1 
and 11) , to distinguish the kind of risk records in the knowledge 
base and the data store of profiles. Thus, claims 1 and 11 are 
here changed to make more clear that the knowledge base holds 
risk records that have quantitative fields (numerical fields or 
subjective fields synchronized to numerical fields) that are 
averages of such fields for completed projects or processes, 
whereas the data store of profiles includes risk records for 
particular projects or processes. Further, the independent 
claims are changed to recite that the updating of the knowledge 
base is an averaging of a profile risk record value into a 
corresponding generic risk record value, as explained at page 21, 
line 28: 

... the generic risks in the knowledge base have values for 
measuring fields (risk inherent likelihood, inherent cost of 
consequence and control effectiveness) that are averages of 
the values used in profiles of various users over time. 

The averaging is explained at page 28, line 7: 

... for example, if 100 measuring field values have already 
been used to determine a value of a measuring field [for a 
generic risk record in the knowledge base] , and the risk 
processor pulls three new values of the same measuring field 
for the same risk from the data store 12 of contexts [i.e. 
profiles] , then the existing value in the knowledge base 11 
will be given a weight of 100, compared to an assumed 
weighting of 1 for each of the three values pulled from the 
data store of contexts. 
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Claim 11 is changed correspondingly, and to expressly recite the 
knowledge base and the data store of profiles recited in claim 1, 
and also the inherent consequence of the method of claim 11 
(which inherent consequence is also recited in claim 1) . 

Regarding the invention as claimed 

Since the Examiner is new to the proceedings for this case, 
applicant here explains in brief the invention as claimed in 
claims 1 and 10 (depending from claim 1) . Claim 1 is directed to 
the use of quantitative risk information obtained in a particular 
project for updating a knowledge base of generic risk 
information, i.e. risk information not having to do with a 
particular project but instead representing accumulated 
experience over many different projects (after some years of use 
of the invention) . Claim 10 is directed to using the generic 
risk information as a starting point for a new project. 

Claim 1 recites a system for use in managing risk, 
comprising a knowledge base, a data store of profiles, and a risk 
processor . 

The knowledge base holds generic risk records--i . e . records 
having to do with a risk in the abstract, as opposed to a risk in 
any actual project — each such record including a plurality of 
fields at least some of which have subjective or quantitative 
values, with the subjective values synchronized to numerical 
values. Thus, e.g. a generic risk record might indicate it is a 
record for risk of cost increases for fuel, and might indicate a 
risk of "moderate." The system includes information that 
translates "moderate" to a numerical value so that it can be 
arithmetically manipulated, for example averaged with a 
quantitative field of another risk record. 

The data store of profiles holds profile risk records each 
associated with a particular prof ile--i . e . a particular actual 
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project — and each including the same plurality of fields as the 
generic risk record . The profile risk records are for use in 
providing a risk assessment in the particular profile/ actual 
project. It is helpful, in understanding the invention as in 
claim 1, to appreciate that the profile risk record is, in the 
context of claim 1, for a project that has already been 
completed, and so the quantitative values of the profile risk 
records for the project are based on actual experience, although 
only for one particular project. 

The risk processor updates subjective or quantitative values 
of generic risk records based on corresponding field values in 
the profile risk records in the data store of profiles. The 
updating is, for example, a simple averaging process. See for 
example page 14, line 7. See also page 21, beginning line 27, 
explaining : 

... the generic risks in the knowledge base have values for 
measuring fields (risk inherent likelihood, inherent cost of 
consequence and control effectiveness) that are averages of 
the values used in profiles of various users over time. 

The result of the updating by the risk processor is that the 

subjective or quantitative values of the generic risk records are 

refined over time based on values of the corresponding fields of 

the profile risk records, and thus, the knowledge base "learns 

over time . " 

So claim 1 is directed to improving the knowledge base. 

Claim 10, on the other hand, is directed to using the knowledge 

base in a particular project. Claim 10 recites that the risk 

processor uses the generic risk records of the knowledge base 

(having quantitative risk values reflecting experience gained 

over many projects), to provide initial values for profile risk 

records, i.e. to provide values for risk in an actual project. 

As explained also at page 21, but starting at line 31: 

A user can extract a risk from the knowledge base and either 
use these learned values or override the values with values 
of the user's own choosing. Typically only some of the 
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risks appropriate to a new profile being created by a user 
will be extracted by the user from the knowledge base. The 
user will in addition create new risks from scratch, as in 
the next step in the particular use of the invention 
illustrated in Fig. 2. 

Thus the generic risk records can be said to serve as templates, 

or starting points for risk assessment for an actual project. 

Request for additional information 

At what is indicated as page 2 of an attachment to the 
Office action (following page 27 of the Office action), the 
Office requests the following additional information: 

a) information regarding KnowRisk Standard 1.0 detailing 
features of the software along with availability information; 

b) information regarding the 1997 launch of KnowRisk 
detailing features of the software from the 1997 launch; 

c) information regarding all editions of KnowRisk available 
during the time period comprising the launch date in 1997 up 
until January 31, 2001, detailing features or methodologies and 
version histories of all such editions of KnowRisk; and 

d) "the citation and a copy of each publication that any of 
the applications [sic] relied upon to develop the disclosed 
subject matter that describes the applicant's invention, 
particularly as to developing KnowRisk ... [and for] each 
publication ... a concise explanation of the reliance placed on 
that publication in the development of the disclosed subject 
matter" ; 

e) "the citation and a copy of each publication which any 
of the applicants authored or co-authored and which describe 
[sic] the disclosed subject matter of risk management, especially 
those disclosing the KnowRisk system"; and 

f) a statement of "the specific improvements of the claimed 
subject matter in claims 1-2 0 over prior art (KnowRisk) and 
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indicate the specific elements in the claimed invention that 
provide those improvements ... [and] for claims expressed as means 
or steps plus function, please provide the specific page and line 
numbers with the disclosure that describe the claimed structure 
and acts . " 

In response to items (a) -(c), the inventors have explained 
the following. KnowRisk 1.0 was released in 1997. The next 
release was KnowRisk 2.0, on 25 September 2000. A copy of the 
release documentation for KnowRisk 2.0 is provided as attachment 
A. KnowRisk version 1.0 includes: 

a knowledge base for maintaining a generic risk record 
including a plurality of fields, but not any fields having 
subjective values synchronized to numerical values; 

a data store of profiles, for maintaining a profile risk 
record associated with a particular profile, but not including 
the same plurality of fields as the generic risk record, 

and no risk processor for updating at least one of the 
subjective or quantitative values of the generic risk record 
based on a corresponding field value in the profile risk record 
in the data store of profiles. 

It is not until version 2.0, with a release date less than 
one year prior to the filing of the present application, that 
KnowRisk included the fields having subjective values 
synchronized to numerical values and a profile risk record 
including the same plurality of fields as a corresponding generic 
risk record. Even today, however, there is no version of 
KnowRisk- -not e ven a Beta test verstion--that includes a risk 
processor for updating at least one of t he subjective or 
quantitative values of the g eneric risk record based on a 
corresponding field value in the profile risk record in the data 
store of profiles. 
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In response to item (d) , the inventors have explained that 
there was no publication in existence as of the filing date that 
described the invention, and thus no application that could have 
been relied on. 

In response to item (e) , the inventors have not authored or 
co-authored any publications describing the disclosed subject 
matter of risk management, irrespective of the KnowRisk system, 
prior to the filing of the application. There have been news 
stories published about KnowRisk, as noted in the Office action, 
which the inventors therefore assume are in the possession of the 
Office and so are not provided here. As the Office must surely 
be aware, these news stories in no way disclose the invention as 
claimed in claim 1, nor in fact do they provide technical details 
of risk management in any respect. 

The inventors have explained that although version 2.0 of 
KnowRisk was not officially released until Sept. 25, 2000, beta 
(test) versions were installed at beta test sites, and an 
advertising brochure was distributed in the United Kingdom prior 
to the official release date. But as noted, even version 2.0 
does not include the updating of the knowledge base, as recited 
in claim 1. A copy of the brochure is attached as Attachment B. 
The earliest date on which the brochure was distributed was Feb. 
1, 2000. (The brochure discloses the use of subjective fields, 
but does not disclose that they are synchronized to numerical 
fields. Nor does it disclose a risk processor for updating at 
least one of the subjective or quantitative values of the generic 
risk record based on a corresponding field value in the profile 
risk record in the data store of profiles. It discloses merely a 
"dynamic" knowledge base.) 

Since filing , there has been publication of the invention 
because of publication of a corresponding PCT application (at the 
18 month-after-filing point) of a corresponding PCT application 
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(PCT/AU02/00094, having international filing date 31 Jan. 2002), 
publication of the present application (2005/0086090, with 
publication date April 25. 2005), and a brochure in first quarter 
2006 including the statement "... a knowledge base that learns from 
your experience " however there is no detail given. 

In response to item (f), please see the response to items 
(a) -(c), explaining that at least the risk processor as in claim 
1 is new compared to the prior art, i.e. the prior art does not 
teach a risk processor for updating a subjective or quantitative 
value of a generic risk record in a knowledge base, based on a 
corresponding field value in a profile risk record in a data 
store of profiles. Thus also, the prior art does not teach using 
the generic risk records as templates/ starting points for 
profile risk records for a project, as in claim 10. 

Also in response to item (f ) , no claims are "expressed in 
means or steps plus function." (The method claims recite "step 
of" but not "step for" and so trigger a presumption that the 
claim is not a "step plus function" claim. See Masco Corp. v. 
United States, 64 USPQ2d 1182, 1189 (Fed. Cir. 2002) ( x We thus 
hold that where a method claim does not contain the term "step[s] 
for, " a limitation of that claim cannot be construed as a step- 
plus- function limitation without a showing that the limitation 
contains no act.') 

In summary, and by way of clarification, there was no 
publication of the invention prior to filing , and in particular 
no publication of the updating of the knowledge base as in claim 
1. Further, the updating has not yet been implemented in any 
version of KnowRisk- -commercial or test. 

Response to Arguments 

At page 2 of the Office action, the Office states that: 
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Applicant argues that Mulholland does not teach or suggest 
what could fairly be likened to a body of risk information, 
including: 

- quantitative risk information in any arrangement 

- risk information for a particular project. 

Applicant respectfully disputes such characterization of 

applicant's argument. In response to the previous Office action, 

applicant stated: 

However , even assuming that the information in Mulholland' s 
knowledge base is organized as records of fields , Mulholland 
does not teach or suggest what could fairly be likened to a 
body of risk information including quantitative risk 
information in any arrangement (recited as generic risk 
records having fields for holding quantitative values) , and 
also risk information for a particular project (recited as a 
risk record having the same fields as the generic risk 
record) , and also a risk processor for updating the former 
body of risk information based on the risk information for a 
particular project. [Some emphasis added, namely the 
emphasis of "and also" in each such occurrence.] 

For the record, applicant concedes that the prior art does teach 

quantitative risk information in at least some arrangements, and 

the prior art does teach risk information for a particular 

project. Applicant's statement is fairly understood to assert 

that Mulholland does not teach a system including a risk 

processor that updates a body of risk information including 

quantitative risk information based on risk information in a 

particular project. As applicant has argued before, Mulholland 

teaches both a risk identification phase and a risk assessment 

phase of risk management. Risk identification has only to do 

with answering "What are the risks?" Risk assessment has to do 

with "How big is a given risk?" And Mulholland teaches making 

use of past experience for risk identification, but does not 

teach making use of past risk management projects to update a 

body of risk information including quantitative risk information . 

More specifically, Mulholland teaches a knowledge base for risk 

identification, but does not teach a knowledge base for risk 

measurement . 
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Applicant can further distinguish over Mulholland, because 
applicant's claims are more narrow than only just what is needed 
to distinguish. Claim 1 recites a risk processor that updates a 
subjective or quantitative value of a generic risk record in a 
knowledge base holding generic risk records each including a 
plurality of fields, based on a corresponding field value in a 
profile risk record in a data store of profiles, where the 
profile risk record has the same plurality of fields as the 
generic risk record. There is thus a data store (of profile risk 
records) holding a risk record for an actual project, including a 
subjective or quantitative field. There is thus also a data 
store (of generic risk records, recited as a knowledge base) . 
The risk processor updates the values of the latter based on the 
former. Mulholland teaches only a knowledge base (hypercard 
system) helpful in a risk identification phase of risk 
management, and also a risk assessment phase of risk management, 
but does not teach the two data stores recited in claim 1, nor 
the updating of one based on values in the other. Further still, 
as amended, claim 1 recites that the updating is an averaging 
process, i.e. the risk record for a particular project is 
averaged into the corresponding value in a corresponding generic 
risk record in the knowledge base. (As explained above, the 
averaging process takes into account how many values have already 
been averaged. Thus, if there are already two that have been 
averaged to form a value on file in the knowledge base, and one 
more is to be averaged into the value, then the value on file is 
given a weight of 2/3 and the new value a weight of 1/3.) 

At page 3 of the Office action, in the response by the 
Office to applicant's arguments, the Office asserts that 
Mulholland discloses a risk processor as recited in claim 1. The 
Office argues that Mulholland discloses the use of commercially 
available application programs called HyperCard and Excel, and 
argues that the use of such computer software programs inherently 
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requires the use of the computer processor for execution, and 
notes that Mulholland at page 12, column 2, lines 57-58, 
discloses that "the Excel spreadsheet model also provides the 
means for sensitivity analyses for different outcomes." The 
Office argues then that the sensitivity analysis, performed by 
varying one element at a time, "thereby updat[es] the body of 
risk information for a particular project." [Emphasis added.] 

Applicant respectfully insists that this assertion by the 

Office misreads the invention as in claim 1. It is not the body 

of risk information for a particular project that is being 

updated in claim 1, but rather the body of risk information 

representing many different projects , i.e. the generic risk 

records. Claim 1 recites a risk processor that uses a profile 

risk record to update a corresponding record in the knowledge 

base of generic risk records. As explained at page 8, line 31, a 

generic risk record is one not associated with any particular 

profile, and as explained at page 21, line 28: 

... the generic risks in the knowledge base have values for 
measuring fields (risk inherent likelihood, inherent cost of 
consequence and control effectiveness) that are averages of 
the values used in profiles of various users over time. 

And as explained above, claim 1 is now changed to make even more 
clear that the generic risk records of the knowledge base 
represent an average over many different projects. 

Further, the cited text in Mulholland in no way teaches or 
suggests even the updating of one data store based on another, 
let alone the updating recited in claim 1, namely the updating of 
generic risk records (representing risk information for many 
projects) based on a profile risk record (representing a risk in 
a particular project) . Mulholland does disclose risk assessment 
(as one phase in risk management) , but applicant is not claiming 
to have invented a risk assessment stage of risk management. 
Applicant claims updating of risk values in a knowledge base 
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based on actual experience, and there is simply no teaching 
whatsoever anywhere in Mulholland of such an updating, which 
results in a knowledge base learning over time. 

At page 5 of the Office action, the Office asserts that 
applicant is arguing features not recited in the claims. 
Specifically, the Office asserts that applicant is arguing the 
updating of historical information based on current information 
and this is not recited in the claims. Applicant respectfully 
submits that this assertion is again due to a misreading of claim 
1. What is being claimed in claim 1 is exactly, although in 
other words, the updating of historical information based on 
current information, as explained here (and as explained in the 
applicant's to each previous Office action) . The field vale of a 
generic risk record in the knowledge base is updated based on a 
corresponding field value of a profile risk record, and as 
explained at page 21, line 28, the generic risk records are "the 
generic risks in the knowledge base are averages of the values 
used in profiles of various users over time." Also, as 
mentioned, claim 1 is now changed to make even more clear that 
the updating of the knowledge base is (in other words) the 
updating of historical information based on current information. 

At page 6 of the Office action, the Office asserts that if 
applicant is claiming particular values within the field, it is 
of no import to the scope of the claim and no patentable weight 
is given to such a claim. Applicant respectfully submits that it 
is not any particular value that is being claimed, but rather the 
process of updating values, whatever the values are, that is 
being claimed. 

At the bottom of page 6 of the Office action, the Office 
responds to applicant's assertion that Mulholland and White in 
combination failed to teach the updating of risk information as 
recited in claim 1, with the maintaining of information in 



-19- 



Attorney Docket No.: 2-591.5 
Serial No. : 09/774, 538 

knowledge base in the same arrangement as for a particular 
project. For the feature of updating risk information, the 
Office again refers to simply Mulholland, but as applicant has 
argued above, Mulholland (alone) does not teach the updating. 
For the feature of maintaining information in the knowledge base 
in the same arrangement as for a particular project, the Office 
asserts that applicant is relying on a feature not recited in the 
claims. Applicant respectfully submits that claim 1 is clear on 
its face as reciting such a feature: claim 1 recites that the 
record in the data store profiles include the same plurality of 
fields as the generic risk records . This is, in other words, the 
subject feature. 

Claim rejections under 35 USC §101 

At page 8 of the Office action, the Office discusses claim 
rejections under 35 USC 101, but never actually rejects any of 
the claims of the application under said section of the US code. 
Applicant nevertheless responds here to statements made by the , 
Office regarding 35 USC 101. The Office states that to be 
useful, as required by 35 USC 101, a claimed invention must yield 
a result that is "specific, substantial, and credible," and 
asserts that the recitation of "maintaining/updating generic risk 
records is not deemed to be specific, substantial, and credible 
because the claimed invention does not have a specific or 
substantial result, nor is there a positive citation of use for 
the result." At the top of page 10, the Office goes on to note 
that, "If, however, the risk records were somehow used in a real- 
world application such as managing projects (based on the 
corresponding identified risk) or generating new generic risk 
templates (used to provide risk analysis of future projects) , 
then the claimed invention would yield a real world, i.e., 
tangible, result. " 
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As explained above, claim 1 quite exactly does claim the 
generating of new generic risk templates in that the updated 
values of the generic risk record are different values and 
therefore new values, and therefore amount to a new generic risk 
template. And as recited in claim 10, these generic risk 
templates are then used for future projects. Therefore, based on 
the criterion given by the Office, the claimed invention is 
useful . 

To the extent that the Office intended to reject any of the 
claims of the application based on 3 5 USC §101, applicant 
therefore respectfully request that such rejections be 
reconsidered and withdrawn. 

Claim rejections under 35 USC §112 

At page 10 of the Office action, in section 5, the Office 
rejects claims 4 and 14 for allegedly not having an antecedent 
basis for "the risk management analysis" in lines 4-5. Applicant 
respectfully points out that claims 4 and 14 depend respectively 
from claims 1 and 11, both of which recited (prior to this paper) 
providing "an analysis of use and managing risk, " and therefore, 
recite providing a risk management analysis. This was the 
antecedent basis. Nevertheless, applicant has here amended 
claims 4 and 14 to recite "a risk management analysis" in the 
body of those claims. Correspondingly, claims 1 and 11 are 
changed to no longer recite providing an analysis of use in 
managing risk." 

Claim rejections under 35 USC §103 

At §6 of the Office action, the Office rejects claims 1-2 
and 4 under 35 USC §103 as being unpatentable over Mulholland. 
The rejection here is substantively the same as in the previous 
Office action. Applicant therefore renews applicant's previous 
response and adds further argument here, based on clarifying 
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language added to the claims. In brief, and as explained above, 
applicant respectfully strongly insists that Mulholland in no way 
can be fairly interpreted to teach a risk processor as recited in 
claim 1, either as amended here, or as examined. The Office 
asserts that the risk processor is disclosed in Mulholland 
because Mulholland teaches a computer hosting the HyperCard 
system in Excel spreadsheets, and because Mulholland teaches 
using the HyperCard system for risk identification. Applicant 
respectfully asks how is this in any way analogous to using a 
risk measured in a particular project to update a generic risk 
record in a knowledge base of generic risk records, so that as a 
result, the generic risk records are refined over time based on 
values of the corresponding fields of the profile risk record, 
which refining is the inevitable result of the risk processing 
recited in claim 1, and which is set out at the end of claim 1 as 
an inherent consequence of what is recited in claim 1. Applicant 
respectfully submits that all that the Office has done is to 
reiterate applicant's own assertion, namely that Mulholland does 
teach a HyperCard system but it is of use only in risk 
identification, and also teaches a risk assessment phase, but 
does not teach anything whatsoever corresponding to the knowledge 
base of generic risk records that are updated over time based on 
profile risk records, as recited in claim 1. 

Further, as explained, claim 1 is now amended to recite that 
the updating process is an averaging process, and no such 
averaging process is disclosed by Mulholland. 

At page 25 of the Office action, claim 11 is rejected for 
the same reasons as claim 1. Thus, the traversal for claim 1 
applies also to claim 11, which includes a limitation 
corresponding to each limitation of claim 1. 

Applicant therefore respectfully submits that the rejections 
of claims 1 and 11 cannot stand since Mulholland fails to teach a 
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knowledge base of generic risk records, and fails to teach a data 
store of profiles having corresponding fields, and fails to teach 
a risk processor updating a record in a knowledge base based on a 
corresponding record in the profile data store, let alone doing 
so based on an averaging process as now claimed. 

Since all of the other claims depend from either claim 1 or 
claim 11, applicant respectfully request that the rejections of 
these other claims be withdrawn at least based on their 
dependencies . 

Conclusion 

For all the foregoing reasons it is believed that all of the 
claims of the application are now in condition for allowance, and 
their passage to issue is earnestly solicited. Applicant ' s 
attorney urges the Examiner to call to discuss the present 
response if anything in the present response is unclear or 
unpersuasive . 



Re sp ec t full y submi 1 1 ed , 




Aug. 11, 2006 

Date Jaiffes'' A. Retter 

Registration No. 41,266 

WARE, FRESSOLA, VAN DER SLUYS 

& ADOLPHSON LLP tel : (203) 261-1234 

755 Main Street, P.O. Box 224 Cust. No.: 004955 

Monroe, CT 06468-0224 



Enc . 

Attach. A: Documentation for official release of KnowRisk 2.0 

Attach. B: Advertisement for KnowRisk distributed on or after 
Feb. 1, 2000. 
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ATTACHMENT B 

^J^JJk is used by a very diverse range of organisations . 
Some examples of <^f$$fc* users are: 

STOCK EXCHANGES HOTELS POWER GENERATION AUTHORITIES 

LARGE RETAILERS INSURANCE COMPANIES COMMERCIAL SERVICE PROVIDERS 

CONSTRUCTION COMPANIES GOVERNMENTS TRANSPORT COMPANIES 

MANAGEMENT CONSULTANTS ACCOUNTANTS AND AUDITORS PUBLIC TRUSTEES 



KnowRisk is a four-dimensional risk 
management system that will elevate risk 
management to the twenty-first century. " 

D.MOORE, GENERAL MANAGER, NATIONAL RISK CONSULTING, 
RICHARD OLIVER INTERNATIONAL 



Superbly easy to customise to your particular requirements, although 
it is usually operated by the manager responsible for risk management, 
^ aS 3 VCr ^ s ^ m P^ e to use 'Executive Overview' module. 
With just a couple of clicks on an executive's desktop PC or laptop, 
they can instantly see the current risk situation company wide or 
by division and department. Of course, ^Cj^g>M^_ t has full security and 
access control features. It is also ftilly compliant with ISO 10006 and 
AS 4360 Risk Management Standards. 



For The Technical 

<$ffj[sh* is not an adaptation of a spreadsheet programme (as many risk management programmes are): 
It was written from the ground up in C+ + and took eleven man-years of programming by a highly 
specialised team. It has an intelligent knowledge database that is built-in in stand-alone models and server 
mounted (on SQL Server, Oracle, etc.) on company-wide models. The <^^S&° executable is written to 
run on Windows 95/98/2000/NT platforms. It can be used in Subjective (words) or Quantitative (numbers) 
mode, or a combination of the two. Version current version, is the result of feedback from numerous 

user group meetings and contains many enhancegnents over Version 1. 

To receive a full brochure, demonstration disc or personal demonstration, 
please email, fax or call the UK distributors: 

ALBANY RISK MANAGEMENT Ltd 

Albany House, Market St. Maidenhead, Berkshire SL6 8BE 

Phone: 01628 421522 Fax: 01628 421523 Attorney Docket No. 2-591, 

Email: knowrisk@btconnect.com Serial No. 09/774,538 




"The cost savings from understanding and managing a 
company's risks, go straight to the bottom line. No well 
managed company can afford to ignore risk management. 
It won't be long before a formal risk management statement 
becomes part of the annual report to shareholders. " 

ALAN GASTON, FINANCIAL -REVIEW, MARCH 1999 

JtlWiW. is sim ply the most advanced and easy to use 

rOSK* professional generic risk management programme available. 

"We scoured the world for the best risk management software 
and finally chose KnowRisk. It, and its knowledge database, 
are now an integral part of our management process 
and are proving to be absolutely invaluable " 

IAN ABRAHAMS, DIRECTOR, THE LMT GROUP (CIVIL ENGINEERING CONSULTANTS) 



Are you satisfied that you and your company know 
everything you should about the risks associated with: 

Director's Liability and Corporate Governance risks? 

Generic company- wide risks? 

Divisional risks? 

Specific departmental risks? 



^~~KiStC is a P° werful risk analysis and risk milnagement tool, 
that not only handles these risks but also the risks associated with 
Company expansion/contraction; New products and services; 
Project management; IT services; as well as the conventional risks 
associated with Property, Insurances, Health and Safety, etc. 

'KnowRisk is both very powerful and easy to use. It is the best I have seen. 
It is also great value for money. It doesn't get any better than that!" 

GRANT BLANCHARD. CHAIRMAN, QUICKNET (INTERNATIONAL TELECOMMUNICATIONS) 




BtST AVAILABLE COPY 



Enterprise 




By Risk Management Professionals 
For Professional Managers 




overview 



BEST AVAILABLE COPY 



The latest in risk management computing tools, 
KnowRisk* provides; 

• Strategic, tactical and operational risks and their 
impacts, and how to control them; 

• Effectiveness of corporate governance and due 
diligence in operation; 

• Strategic, prioritised action plans to mitigate exposure; 

• Controls self assessment strategies to drive controls 
improvement; 

• Subjective, semi -quantitative and quantitative 
calculations; 

• Current Maximum Foreseeable Loss plus any 
level of exposure; 

• Weaknesses and over insurance in the current 
insurance program. 

• Ability to "drag and drop" between most Windows® 
applications (Word® Excel® MS Project®, 
Wordperfect®, Lotus 1,2,3® etc); 

KnowRisk® applies a dynamic Knowledge Base to 
organisation-based collections of Risks called 
"Profiles", allowing: 

• Assessment of the effectiveness of control measures; 

• Convenient and secure communication about Profile 
performance; 

•Tracking and review of progress towards mitigation 
targets; 

• Distribution of- risks to other users* 

• Sign-offs and confirmation of risk positions; 

• Internal audit and legal compliance; 

• Continuous monitoring of selected risks; 

• Overdue alerts on the Action Plan; 

We used KnowRisk® Version 1 Jot over a 
year on world-wide assignments. The 
additional features in Version 2 makes 
KnowRisk® the clear leader in its field" 

Gordon Hhx, Managing Consultant, 
Richard Ouver International, United Kingdom. 



After giving Jane Holmes, Risk Strategy' 
Support Officer, some work to perform in 
KnowRisk®, I received a call from her stating 
she must have made a mistake, as it was too 
easy. There was no mistake, KnowRisk® has 
proved to be a very productive and effective 
tool for assisting us manage our projects 
from a risk perspective** 

Bgrnk Spencer, Director, Risk Strategy, Bauldcrstonf. Hornibrook Pry Ltd. 




users can easily drag and 
drop between applications. 

Wizards 

KnowRisk* uses automated Wizards to help users: 

• Create and update their proprietary Knowledge Base; 

• Approve new information prior to its inclusion in 
the Knowledge Base; 

• Create and customise information display layouts; 

• Create, update and delete Risk Profiles; 

• Create Forms for Risk Profile data collection; 

• Create detailed Risk Profile reports and 
summaries. 
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Knowledge Base 



The Knowledge Base, a sophisticated relational 
database, stores risk related details of the 
organisation whose risks are to be managed: 

•The organisations hierarchy of business units, 
or Organisation Breakdown Structure (OBS); 
•Those business units geographical Locations; 

• The Work or Functions or Processes that each 
business unit performs; 

• Insurance Policies for transferring risk impacts. 

Using an established risk management process 
(eg AS/NZ 4360, ISO 10006), a Risk Manager 
may also identify and add to the Knowledge 
Base details of potential and actual: 

• Risks facing the organisation; 

• Impacts or Consequences of those Risks; 

• Controls on those Risks and Consequences; 
and may link Risks to their Consequences and 
Controls for automatic inclusion in Profiles. 




Details of particular risks 
within a Profile added Jrom 
the Knowledge Base. 



I found KnowRisk® to be a most invaluable 
support to establish an ongoing Risk Management 
strategy for controlling the highest risks. 
I can see this approach being implemented 
worldwide Jbr all major projects in the 



construction business 



Gerhard Ziems, Audit Representative, Bilfinger + Bercer, Germany 




hems in the Knowledge Base can 
be selected and copied to a Profile. 



Profiles 



Knowfttsk 9 Pro, Std for Networks, Std and lite use 
Profiles in Contexts, such as by Functions, Assets, 
Work categories: 

* Business Unit Profiles for tracking business units' 
exposure and progress towards achieving mitigation 
targets; 

* Context Profiles which link common Risks, 
Consequences and Controls to any Profile 
necessary for conducting Risk studies; 

' Simple but powerful means for modelling "what if" 
scenarios which may then be used to calculate the 
subjective or fully quantitative values of Risk exposure 



/TO 



The KnowRisk® Product Range 

KnowRisIf Pro: is an enterprise level application, 
designed specifically for multiple users, using a central 
relational database such as MS SQL Server or Oracle, 
on the customer s server(s) and LAN /WAN. It has all 
the available features and is able to exchange data with 
Standard for Networks, Standard and Mobile. 

KnowRisk 9 Standard for Networks: 

is installed on the customer s LAN and is designed to 
assist a smaller number of users who may want to use 
the application but do not have a corporate back-end 
database. It has its own built-in database and allows 
one user only to access the databases at one time, that 
is * 1 concurrent user' at a time, but any number of 
users can have non- concurrent access. It incorporates 
most of the non -enterprise features of Pro and can 
exchange data with Pro, Standard and Mobile. 

KnowRisk 8 Standard: is a stand -alone single user 
only application incorporating most of the non- 
enterprise features of Pro but operating with 
multiple databases on the single user's local hard 
disk. It can exchange data with Pro, Standard for 
Networks and Mobile. 
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Executive Overview 



Corporate Risk 




Connect to LAN 



•Stand-alone units not connected to the' network 
but can share information via floppy disk 

Example of a typical installation 



Recommended minimum PC specifications 



Windows '95 or higher 




CPU Pea 


fern* 11 2S0 MHz or higher 


Pro 


Std for 
Networks 


Std 


Lite 


Mobile 


RAM 128MB 


64MB 


64MB 


64MB 


64MB 


Hard Disk 50MB 


50MB 


50MB 


20MB 


20MB 



KnowRisk 3 Lite: is a stand-alone single user basic 
application incorporating a number of the features of 
Standard, operating with only a single database on the 
single users local hard disk. It cannot share data with 
other models. 



KnowRisk 8 Mobile: is a basic version intended to 
be used by users who have access to KnowRisk® Pro, 
Standard for Networks or Standard, who require 
the flexibility of working away from the office on a 
laptop computer. KnowRisk® Mobile can transfer 
information to and from KnowRisk® Pro, Standard 
for Networks and Standard, so that data can be 
pre-loaded prior to a field trip or to be worked on at 
home, and then the revised data automatically input 
on return to the office. Many Pro and Standard for 
Network users also have a number of Mobile units. 



Complies with the Turnbull 
Committee Recommendations 
for risk management. 



The above versions enable the program to be used in 
different combinations, within the same organisation, 
to suit the operating environment of the end user, 
particularly as the user s data can be "downloaded" 
and "uploaded" between a number of the models. 

Refer to the product list for the complete list of 
features available. 



For further information please contact 

Albany Risk Management Ltd 

Albany House, Market St. 

Maidenhead, Berkshire SL6 8 BE 

Phone; 01628 421522 Fax: 01628 421523 

Email: knowr isk@b tconnect . com 



Q Q 
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Layout/Filters 

Users may configure the KnowRisk 9 interface 
to display any combination of data by: 

•Modifying the supplied Layouts of Profiles, Forms, 
Reports and Knowledge Base data entry screens; 

• Creating their own Risk Management Methods 
from scratch; 

* Creating, editing and applying Filters to sort 
information on Profiles, thereby reducing the 
risk of information overload! 

Forms 

To help Risk Managers gather and update data, 
KnowRisk® Pro, Std for Networks, Std and Lite 
include a number of customisable forms which 
. can be printed out and filled in by hand "at the 
coalface". Forms data can then be keyed into 
KnowRisk® Pro, Std for Networks, Std or Lite 
back at the workstation. 

Reports 

Customisable, printable summaries and reports 
give clear, concise indication of exposure, the 
effectiveness of Controls and progress towards 
mitigation targets. These overviews are enhanced 
extensively by graphs using industry-standard 
expressions for target and actual exposures. 




Many different reports, charts and graphs 
are available to summarise data in easy to 
assimilate Jormats and pass on to colleagues. 




As users become more experienced, they 
can create their own screens and reports. 




Filters can be created using 
various values and expressions 



Perpetual has introduced an innovative risk 
management program across the group, based 

upon Control Self Assessment (CSA).A key 
enabler of the success of this program has been 
KnowRisk®. Indeed, without KnowRisk®, it is 
probable that our objectives of the program 
would not have been achieved 

{ Mikk Ryan, Naiionaj. Biisincvl Rkvicw Manager. 
Pcrpltual Trustees AtKrRALiA U.MrrKo 



Organisation 



Division 



Business Unit 



Causes 



Risks 



Controls 
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